Update task fails on standalone ENSL10.7.12 or when managed by air-gapped ePolicy Orchestrator

Technical Articles ID: KB96148
Last Modified: 2022-12-02 12:06:04 Etc/GMT

Environment

Endpoint Security for Linux Threat Prevention (ENSLTP) 10.7.12 or later
Trellix Agent (TA) 5.7.x

Problem

After you install the ENSL10.7.12 or later on a standalone environment or an environment managed by air-gapped ePO, the update task fails.

When you execute the update task manually, you see the following error:

# /opt/McAfee/ens/tp/bin/mfetpcli --runtask --index 3
Failed to run the Task

You see errors similar to the following recorded in the mfetpd.log (/var/McAfee/ens/log/tp) file:

Nov 09 18:44:52 centos76 ERROR msgbus [1182] Unable to send the service <ma.service.scheduler> pipe name request msg to broker
Nov 09 18:44:52 centos76 ERROR AMUpdater [1182] DAT and Engine update failed to start, error code: 508
Nov 09 18:44:52 centos76 ERROR TaskManager [1182] Task - Default Client Update task failed to start

Cause

The MsgBus certificates aren't up to date. The certificates ensure communication between TA and the Trellix-managed products such as ENSL.

Solution

Update the MsgBus certificate package within ePO. The roll out of newly added MsgBus certificates happens automatically with a daily frequency. You can obtain the MsgBus packages (usually MsgBusCertsUpdater.zip) from the Product Downloads site, using a valid Grant Number to log on. You can also obtain the MsgBus packages through the ePO Software Manager if ePO has connectivity to the internet. When the MsgBus update has been automatically distributed and rolled out, content updates resume according to the schedule set up originally.
For more information about the TA MsgBus Cert Updater 5.7.7.435, see KB95958 - Trellix Agent MsgBus cert updater package 5.7.7.435 contains updated Musarubra and McAfee Inc Certificates.

Workaround

To manually update the MsgBus certificate in a standalone environment, perform the steps below:

Download MsgBus certificate Updater from the Product Downloads site.

IMPORTANT: You need a valid Grant Number for access.
Extract the MsgBusCertsUpdater.zip to the temporary directory.
Copy the cert file in the MsgBusCertsUpdater.zip to the following path:

/var/McAfee/agent/certstore
Restart the Agent service using the following command:

/etc/init.d/cma restart

NOTE: If the computer is online, an internal task runs at midnight automatically to update the MsgBus cert. For more information about the internal task, see KB85552 - ma.cert.update.task fails nightly at 00:00 local system time on McAfee Agent endpoints.

Related Information

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Update task fails on standalone ENSL10.7.12 or when managed by air-gapped ePolicy Orchestrator

Environment

Problem

Cause

Solution

Workaround

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Update task fails on standalone ENSL10.7.12 or when managed by air-gapped ePolicy Orchestrator

Environment

Problem

Cause

Solution

Workaround

Related Information

Affected Products

Languages:

Choose your region

Title

Title